CVE-2026-55537: CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition in MervinPraison PraisonAI

PraisonAI, a multi-agent teams system, suffers from a time-of-check to time-of-use (TOCTOU) race condition in versions before 4.6.58. The method JobSubmitRequest.validate_webhook_url() accepts webhook URLs even when DNS resolution fails with socket.gaierror due to an exception handler that suppresses this error. Subsequently, JobExecutor._send_webhook() performs a new DNS lookup at request time, which can be manipulated by DNS changes to redirect webhook requests to unintended internal services. This flaw allows an attacker with limited privileges to influence webhook destinations, potentially causing high confidentiality impact and limited integrity impact. The vulnerability is addressed in version 4.6.58.

The vulnerability allows an attacker to redirect webhook requests to internal services by exploiting a race condition in DNS resolution. This can lead to high confidentiality impact by exposing internal services or data and limited integrity impact due to potential manipulation of webhook destinations. There is no impact on availability. The CVSS 3.1 score is 7.1 (high), reflecting network attack vector, high complexity, low privileges required, no user interaction, and scope change.

This vulnerability is fixed in PraisonAI version 4.6.58. Users should upgrade to version 4.6.58 or later to remediate the issue. No other mitigation guidance is provided or necessary as the fix addresses the root cause.